What DPDP spells for FMCG: India’s biggest advertisers face the consent test

The Digital Personal Data Protection Act is expected to be notified today, and with it, India’s advertising industry enters a new regime. No category has more at stake than FMCG, which accounts for nearly a third of India’s advertising expenditure. The sector sits at the sharp edge of consumer data capture, whether through loyalty programmes, quick commerce tie-ups, retail media networks or direct-to-consumer platforms. That makes it the first to feel the weight of new obligations around consent, purpose limitation and deletion, and the first to discover whether compliance can also be a competitive advantage.

The numbers explain the urgency. Indian AdEx is projected at ₹1.37 trillion in 2025, with digital spends rising to about ₹728 billion. FMCG alone contributes around 27 to 30 per cent of this pie, making it the single largest advertiser in the country. Global estimates suggest that between 60 and 73 per cent of first-party data collected by brands goes unused. In other words, the industry that spends the most is also the one most guilty of hoarding under-used information.

The DPDP Act raises the stakes by attaching real penalties to that behaviour: fines up to ₹250 crore for failing to protect personal data, and mandatory deletion once a business purpose is fulfilled. For a sector where billions are spent chasing low-margin, high-frequency consumers, the rules could be transformational.

Also read: Is DPDP the key to data protection and digital growth?

Vinay Tamboli, CEO of DataQuark at LS Digital, says the FMCG category is already realising how much heavier the lift has become. “First-party data has become the foundation of strategic intelligence for FMCG brands during this festive season. In addition to powering targeted campaigns, it allows brands to get deeper consumer insights, such as purchasing behaviour, repeat-buying behaviour, and evolving preferences, to influence product innovation or portfolio shifts,” he explains.

Jacob Joseph, VP of Data Science at CleverTap, argues that the timing of enforcement, landing right before India’s peak festive quarter, forces FMCG brands to get the basics right from day one. “Unlike banks or telcos, the FMCG industry has only recently started building meaningful first-party datasets through D2C channels, loyalty programmes, and quick commerce. So, the timing of enforcement, right before the festive surge, forces brands to grow this muscle responsibly from day one,” he says.

For him, the risk is not that marketers will collect too little, but that they will collect badly. “The knee-jerk response would be to collect less, but the smarter response is to collect better. If you ask for consent with clarity and give people a visible value exchange, you end up with data that’s both compliant and richer,” he adds. Joseph believes that sharper focus on signals that matter like repeat purchases, pack size upgrades, and co-purchase patterns, is enough to shape launches and loyalty without creeping into areas users didn’t sign up for.

Tamboli points to evidence of increased purchasing in premium gifting categories like chocolates, which can lead to limited-edition variants for urban consumers. The same data, when applied to loyalty, allows for personalised rewards targeted only at high-value buyers. He notes that stewardship is becoming the operative word: “Brands are building privacy and consent into every corner of their ecosystem…privacy-first design principles are woven into predictive models and partner integrations, protecting customers’ trust while still powering insights for personalisation.”

Also read: Ashwini Vaishnaw on DPDP Act

Beyond expert views, the market context reinforces why this shift is unavoidable. PwC’s 2024 Consumer Intelligence Survey found that 63 per cent of Indian internet users worry about how their data is used by advertisers. That anxiety is colliding with a structural shift in media: global projections suggest that by 2026 over 70 per cent of digital ad budgets will be anchored on first-party data, even as CRM and CDP penetration in large Indian enterprises remains under 25 per cent. In short, Indian FMCG brands are being asked to catch up on two fronts simultaneously: building reliable first-party datasets and embedding privacy safeguards into every interaction.

Harshada Chitale, Account Director at White Rivers Media, frames the Act as an accelerator, not a constraint. “The DPDP Act has accelerated this maturity by placing consent and transparency at the centre of data strategy. Rather than being restrictive, it has encouraged brands to design clear value exchanges (early access, tailored offers, or exclusive ranges) that build trust while enriching insight quality,” she says.

For her, responsible data use is becoming a currency in itself. “The brands that combine privacy-first practices with intelligence-led planning will not only strengthen festive outcomes but also secure durable consumer relationships in a market where trust is as valuable as growth.”

Venkat Mallik, Founder and CEO of J7, offers a more pragmatic view, noting that implementation complexity will be the real test. “The DPDP Act is yet to be implemented fully but it has been useful as a guideline for the larger brands and businesses to collect and use customer data responsibly. Brands are using insights from the accumulated festive season data to decide their strategy in terms of festive portfolio, bundling, offers, etc. It will be interesting to see how the implementation of the Act plays out considering the complexity in ensuring compliance,” he says.

Mallik expects offline retail to remain critical: “The use of this data by digital-first brands is quite obvious, but the use of the data by physical retail-led brands, through partnerships with retail brands and collection of the purchase behaviour data at the point of sale will also keep increasing.”

Also read: DPDP Draft consultation window closes: Are businesses ready?

The DPDP Act sets out principles of consent, minimisation and purpose limitation that are not revolutionary elsewhere but mark a major cultural shift for Indian advertising. The familiar model of catch-all checkboxes, bloated data collection, and indefinite storage is no longer legally defensible. The opportunity, as several experts suggest, is to turn this constraint into discipline. By capturing only what is essential, building consent flows that actually communicate value, and protecting data through encryption and governance, FMCG brands can transform compliance into trust.

And trust may prove the real growth lever. Studies show that brands which embed privacy and responsibility into their data practices see not only higher opt-in rates but also longer-term customer loyalty. In a sector where loyalty is notoriously fragile, that shift could mean the difference between another short-term festive bump and the kind of durable relationship that compounds over time.

As the DPDP Act comes into force, the task for FMCG marketers is clear. They must prove that India’s biggest advertisers can also be its most responsible custodians of consumer data. If they succeed, they will not just avoid fines but build the kind of consent-driven relationships that make marketing spend more efficient and sustainable. If they stumble, the cost will not just be measured in crores, but in the erosion of consumer trust that no festive campaign can buy back.